[Bug]: The wildcard in the security policy settings seems to be ineffective

[CirnoSalt]

Summary

Security policy configuration is not working

Affected component

security/sandbox

Severity

S1 - workflow blocked

Current behavior

I have made the following settings, but the AI told me that it still cannot use any shell commands, and the blocking message is:

Command not allowed by security policy
Error: Resolved path escapes workspace

[autonomy]
level = "full"
workspace_only = false
allowed_commands = ["*"]
forbidden_paths = []
max_actions_per_hour = 10000
max_cost_per_day_cents = 500
require_approval_for_medium_risk = false
block_high_risk_commands = false
shell_env_passthrough = []
auto_approve = ["*"]
always_ask = []
allowed_roots = []
non_cli_excluded_tools = []

Expected behavior

AI can execute any shell command without restriction

Steps to reproduce

default_temperature = 0.7
model_routes = []
embedding_routes = []

[observability]
backend = "none"

[autonomy]
level = "full"
workspace_only = false
allowed_commands = ["*"]
forbidden_paths = []
max_actions_per_hour = 10000
max_cost_per_day_cents = 500
require_approval_for_medium_risk = false
block_high_risk_commands = false
shell_env_passthrough = []
auto_approve = ["*"]
always_ask = []
allowed_roots = []
non_cli_excluded_tools = []

[runtime]
kind = "native"

[runtime.docker]
image = "alpine:3.20"
network = "none"
memory_limit_mb = 512
cpu_limit = 1.0
read_only_rootfs = true
mount_workspace = true
allowed_workspace_roots = []

[reliability]
provider_retries = 2
provider_backoff_ms = 500
fallback_providers = []
api_keys = []
channel_initial_backoff_secs = 2
channel_max_backoff_secs = 60
scheduler_poll_secs = 15
scheduler_retries = 2

[reliability.model_fallbacks]

[scheduler]
enabled = true
max_tasks = 64
max_concurrent = 4

[agent]
compact_context = false
max_tool_iterations = 100
max_history_messages = 50
parallel_tools = false
tool_dispatcher = "auto"

[skills]
open_skills_enabled = false
prompt_injection_mode = "full"

[query_classification]
enabled = false
rules = []

[heartbeat]
enabled = false
interval_minutes = 30

[cron]
enabled = true
max_run_history = 50

[channels_config]
cli = true
message_timeout_secs = 300

[channels_config.telegram]
bot_token = ""
allowed_users = ["*"]
stream_mode = "off"
draft_update_interval_ms = 1000
interrupt_on_new_message = false
mention_only = false

[memory]
backend = "sqlite"
auto_save = true
hygiene_enabled = true
archive_after_days = 7
purge_after_days = 30
conversation_retention_days = 30
embedding_provider = "none"
embedding_model = "text-embedding-3-small"
embedding_dimensions = 1536
vector_weight = 0.7
keyword_weight = 0.3
min_relevance_score = 0.4
embedding_cache_size = 10000
chunk_max_tokens = 512
response_cache_enabled = false
response_cache_ttl_minutes = 60
response_cache_max_entries = 5000
snapshot_enabled = false
snapshot_on_hygiene = false
auto_hydrate = true

[storage.provider.config]
provider = ""
schema = "public"
table = "memories"

[tunnel]
provider = "none"

[gateway]
port = 42617
host = "127.0.0.1"
require_pairing = true
allow_public_bind = false
paired_tokens = []
pair_rate_limit_per_minute = 10
webhook_rate_limit_per_minute = 60
trust_forwarded_headers = false
rate_limit_max_keys = 10000
idempotency_ttl_secs = 300
idempotency_max_keys = 10000

[composio]
enabled = false
entity_id = "default"

[secrets]
encrypt = false

[browser]
enabled = true
allowed_domains = ["*"]
backend = "agent_browser"
native_headless = true
native_webdriver_url = "http://127.0.0.1:9515"

[browser.computer_use]
endpoint = "http://127.0.0.1:8787/v1/actions"
timeout_ms = 15000
allow_remote_endpoint = true
window_allowlist = []

[http_request]
enabled = true
allowed_domains = ["*"]
max_response_size = 0
timeout_secs = 0

[multimodal]
max_images = 4
max_image_size_mb = 5
allow_remote_fetch = true

[web_search]
enabled = true
provider = "duckduckgo"
max_results = 5
timeout_secs = 15

[proxy]
enabled = false
no_proxy = []
scope = "zeroclaw"
services = []

[identity]
format = "openclaw"

[cost]
enabled = false
daily_limit_usd = 10.0
monthly_limit_usd = 100.0
warn_at_percent = 80
allow_override = false

[cost.prices."anthropic/claude-opus-4-20250514"]
input = 15.0
output = 75.0

[cost.prices."anthropic/claude-3-haiku"]
input = 0.25
output = 1.25

[cost.prices."openai/o1-preview"]
input = 15.0
output = 60.0

[cost.prices."google/gemini-1.5-pro"]
input = 1.25
output = 5.0

[cost.prices."anthropic/claude-3.5-sonnet"]
input = 3.0
output = 15.0

[cost.prices."openai/gpt-4o"]
input = 5.0
output = 15.0

[cost.prices."openai/gpt-4o-mini"]
input = 0.15
output = 0.6

[cost.prices."google/gemini-2.0-flash"]
input = 0.1
output = 0.4

[cost.prices."anthropic/claude-sonnet-4-20250514"]
input = 3.0
output = 15.0

[peripherals]
enabled = false
boards = []

[agents]

[hooks]
enabled = true

[hooks.builtin]
command_logger = false

[hardware]
enabled = false
transport = "None"
baud_rate = 115200
workspace_datasheets = false

[transcription]
enabled = false
api_url = "https://api.groq.com/openai/v1/audio/transcriptions"
model = "whisper-large-v3-turbo"
max_duration_secs = 120

Impact

Restrictions were applied to my own Telegram bot conversation

Logs / stack traces

ZeroClaw version

v0.1.6

Rust version

rustc 1.93.1

Operating system

Ubuntu 25.10

Pre-flight checks

• I reproduced this on the latest main branch or latest release.
• I redacted secrets/tokens from logs.
• I removed personal identifiers and replaced identity-specific data with neutral placeholders.

[github-actions]

Thanks for opening this issue.

Before maintainers triage it, please confirm:

• Repro steps are complete and run on latest main
• Environment details are included (OS, Rust version, ZeroClaw version)
• Sensitive values are redacted

This helps us keep issue throughput high and response latency low.

[theonlyhennygod]

Implemented and verified in this fix set. Security policy wildcard behavior and path-policy handling were updated so fully permissive autonomy settings no longer get blocked by unintended workspace-path escape checks.\n\nClosing as fixed. If anyone can still reproduce on latest main, comment with the exact config and repro steps and we can reopen.

[CirnoSalt]

Implemented and verified in this fix set. Security policy wildcard behavior and path-policy handling were updated so fully permissive autonomy settings no longer get blocked by unintended workspace-path escape checks.\n\nClosing as fixed. If anyone can still reproduce on latest main, comment with the exact config and repro steps and we can reopen.

Updated to 0.1.7, the issue seems not to be completely resolved. The configuration is the same as above, and AI returns the following blocking message:

Analysis of Blocked Linux Commands by Security Policy

Based on my testing, here are the commands that are blocked by the security policy:

---

**Package Management Commands**
- pip install - Error: Command not allowed by security policy: pip install --version
- apt - Error: Command not allowed by security policy: apt --version
- yum - Error: Command not allowed by security policy: yum --version
- npm - Error: Command not allowed by security policy: npm --version

---

**Privileged/System Commands**
- sudo - Error: Command not allowed by security policy: sudo --version
- passwd - Error: Command not allowed by security policy: passwd --version
- useradd - Error: Command not allowed by security policy: useradd --version
- userdel - Error: Command not allowed by security policy: userdel --version
- groupadd - Error: Command not allowed by security policy: groupadd --version

---

**File System/Dangerous Commands**
- rm - Error: Command not allowed by security policy: rm --version
- rmdir - Error: Command not allowed by security policy: rmdir --version
- dd - Error: Command not allowed by security policy: dd --version
- mkfs - Error: Command not allowed by security policy: mkfs --version
- fdisk - Error: Command not allowed by security policy: fdisk --version
- chown - Error: Command not allowed by security policy: chown --version
- chmod - Error: Command not allowed by security policy: chmod --version

---

**Network/Security Commands**
- iptables - Error: Command not allowed by security policy: iptables --version
- nmap - Error: Command not allowed by security policy: nmap --version
- tcpdump - Error: Command not allowed by security policy: tcpdump --version

---

**Process Management Commands**
- killall - Error: Command not allowed by security policy: killall --version
- pkill - Error: Command not allowed by security policy: pkill --version
- crontab - Error: Command not allowed by security policy: crontab --version

---

**Git Operations**
- git clone - Error: Command not allowed by security policy: git clone https://github.com/zeroclaw-labs/zeroclaw.git /tmp/test-repo

---

**Redirection/Complex Commands**
- Commands with > (output redirection) - Error: Command not allowed by security policy: echo "test" > /tmp/test.txt
- Some complex chained commands with && - Error: Command not allowed by security policy: which python3 && python3 --version

---

**Commands That Work**
- Basic file operations: ls, cat, grep, awk, sed, head, tail, find
- System info: pwd, whoami, hostname, id, groups, uname, df, free, nproc
- Network tools: wget, curl, ping, ssh, scp, rsync
- Development tools: python3, git (other commands work), docker
- Compression: tar, gzip, unzip, 7z
- Utilities: jq, bc, nc, ps, top, htop, ss, systemctl, journalctl
- Pipes (|) work fine

---

**Summary**

The security policy blocks:
1. All package managers (pip install, apt, yum, npm)
2. Privileged commands (sudo, passwd, useradd, userdel, groupadd)
3. Dangerous file operations (rm, dd, mkfs, fdisk, chown, chmod)
4. Network security tools (iptables, nmap, tcpdump)
5. Process kill commands (killall, pkill, crontab)
6. git clone specifically
7. Output redirection (`>`) and some complex chained commands

[AnNingUI]

The same goes for QQ Bot